main.d3kb4suwyv1jyt.amplifyapp.com
Open in
urlscan Pro
13.32.24.70
Malicious Activity!
Public Scan
Submitted URL: https://main.d3kb4suwyv1jyt.amplifyapp.com/
Effective URL: https://main.d3kb4suwyv1jyt.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Submission: On March 05 via manual from US
Effective URL: https://main.d3kb4suwyv1jyt.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Submission: On March 05 via manual from US
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 13.32.24.70, located in
United States and
belongs to AMAZON-02, US.
The main domain is main.d3kb4suwyv1jyt.amplifyapp.com.
TLS certificate: Issued by Amazon on February 26th 2021. Valid for: a year.
This is the only time main.d3kb4suwyv1jyt.amplifyapp.com was scanned on urlscan.io!
TLS certificate: Issued by Amazon on February 26th 2021. Valid for: a year.
This is the only time main.d3kb4suwyv1jyt.amplifyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Amazon (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 13.32.24.70 13.32.24.70 | 16509 (AMAZON-02) (AMAZON-02) | |
| 7 | 1 |
7
13.32.24.70
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-13-32-24-70.fra56.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-13-32-24-70.fra56.r.cloudfront.net
| main.d3kb4suwyv1jyt.amplifyapp.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
amplifyapp.com
main.d3kb4suwyv1jyt.amplifyapp.com |
38 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | main.d3kb4suwyv1jyt.amplifyapp.com |
main.d3kb4suwyv1jyt.amplifyapp.com
|
| 7 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.amazon.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.d3kb4suwyv1jyt.amplifyapp.com Amazon |
2021-02-26 - 2022-03-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://main.d3kb4suwyv1jyt.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D
Frame ID: 6C6BE716F3FF68F913A6A060628D5BF6
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://main.d3kb4suwyv1jyt.amplifyapp.com/ Page URL
- https://main.d3kb4suwyv1jyt.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2O... Page URL
Detected technologies
Amazon Web Services
(PaaS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers via /\(CloudFront\)$/i
- headers server /^AmazonS3$/i
Amazon Cloudfront
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers via /\(CloudFront\)$/i
Amazon S3
(Miscellaneous)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^AmazonS3$/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
URL: http://www.amazon.com/gp/feature.html/ref=nav_sap_clddrive_1a?ie=UTF8&docId=1000796931
Search URL Search Domain Scan URL
URL: http://www.amazon.com/b/ref=nav_sap_audible_a?ie=UTF8&node=2402172011
Search URL Search Domain Scan URL
URL: http://www.amazon.com/New-Future-Releases/b/ref=nav_sap_vg_sony?ie=UTF8&node=496994
Search URL Search Domain Scan URL
URL: http://www.amazon.com/Women-Clothing/b/ref=nav_sap_clothing_image?ie=UTF8&node=1040660
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://main.d3kb4suwyv1jyt.amplifyapp.com/ Page URL
- https://main.d3kb4suwyv1jyt.amplifyapp.com/billing.html?amazon.com/b/ref=si3_store_su/?ie=UTF8&node=293522011Blv1KxDr2OE5uAPrZw%3D Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
main.d3kb4suwyv1jyt.amplifyapp.com/ |
136 B 508 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
billing.html
main.d3kb4suwyv1jyt.amplifyapp.com/ |
88 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
site-wide-a04329._V1_.css
main.d3kb4suwyv1jyt.amplifyapp.com/content/ |
31 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
BeaconSprite-US-01._V141013396_.png
main.d3kb4suwyv1jyt.amplifyapp.com/content/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
transparent-pixel._V192234675_.gif
main.d3kb4suwyv1jyt.amplifyapp.com/content/ |
43 B 413 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
confirm-card._V17236_.png
main.d3kb4suwyv1jyt.amplifyapp.com/content/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
navAmazonLogoFooter._V169459313_.gif
main.d3kb4suwyv1jyt.amplifyapp.com/content/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Amazon (Online)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| container object| AmazonPopoverImages string| _navbarSpriteUrl function| Navbar object| _navbar undefined| iss string| issHost string| issMktid object| issSearchAliases function| updateISSCompletion undefined| dealNotifier object| errant0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
main.d3kb4suwyv1jyt.amplifyapp.com
13.32.24.70
10765b5e83a4ccbc5edbfcc4f3ada63b02c76cc1d29c21f1202fc54bd018710c
1475fda7a4d309c9341051023781959c711902cfe480c4426e0d62e73dded943
4514d4d04b4644de38864be5ac0c945f94eec540dcef27061330658e46d848a9
b924ce130dc972a751e5bd741fb35cd7cb8d7a94894916d941f48e35abddf5dc
bde31848f3c02d44b188927f63b8724262cf12a30a2bef988f81698ecbbf5790
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
d2156baa830ff25327e1de2e5806d2ba38ad82c82e745748744c8907fe7754d9